CVE-2026-31234 Details
Description
Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed task coordination, lacks authentication and authorization controls, allowing any remote attacker to write arbitrary data via HTTP PUT requests. When a Horovod worker reads data from the KVStore (via HTTP GET), it deserializes the data using cloudpickle.loads() without verifying its source or integrity. An attacker can exploit this by sending a malicious pickle payload to the server before the legitimate data is written, causing the victim worker to deserialize and execute arbitrary code, leading to remote code execution.
A vulnerability allowing insecure deserialization has been identified in Horovod versions through 0.28.1. This issue resides in the KVStore HTTP server component, which is used for distributed task coordination. The KVStore server lacks proper authentication and authorization controls, enabling remote attackers to send arbitrary data via HTTP PUT requests. When a Horovod worker retrieves data from the KVStore using HTTP GET, it deserializes the data with cloudpickle.loads() without verifying its source or integrity. This flaw can be exploited by sending a malicious pickle payload to the server before the legitimate data, causing the worker to deserialize and execute arbitrary code, resulting in remote code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/horovod/horovod | [email protected] | ProductSource CodeVendor |
| https://www.notion.so/CVE-2026-31234-35d1e139318881d585cde508b9d2453c | [email protected] | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Horovod | <= 0.28.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |